REMARKS/ARGUMENTS 

In view of the above amendments and the following remarks, reconsideration and 
a withdrawal of all rejections, and allowance of the pending claims is earnestly solicited. 

The Claims Have Been Amended to Address the Sec. 101 Rejection. 

Claims 1-6 stand rejected under 35 U.S.C. 101 as being directed to non-statutory 
subject matter. This rejection is respectfully traversed in view of the amendments. 

The Examiner has indicated that the claim language appears not to recite a final 
tangible result from the scanning step. Applicant has fijrther articulated the invention by 
reciting that the step of scanning the results of said interpretation for the presence of 
proscribed code is accomplished and the method also includes: 

identifying proscribed code in said results, and making said results 

available to a reporter for reporting or to a processor for further processing 

of said results with a processing component . 
This amendment is fiiUy supported by the specification, and no new matter has been 
introduced. (See Applicant's Specification, f)i [0021], [0027], [0029-30]) For these 
reasons, Applicant hereby respectfully requests reconsideration and a withdrawal of the 
101 rejection. 

The References Fail to Teach. Suggest or Disclose the Applicant's Invention . 

Claims 1-4 and 6 stand rejected under 35 USC 103(a) as being unpatentable over 
Jordan (2002/0073323 Al) in view of Davidson. This rejection is respectfully but 
strenuously traversed and reconsideration and a withdrawal of the rejection are hereby 
requested. 
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The Examiner previously rejected claims 1-4 and 6 over Jordan. Applicant's prior 
comments were persuasive in overcoming that rejection. The Examiner, in the new 
rejection, now combines the reference of Davidson with Jordan to attempt to fill admitted 
deficiencies of Jordan, namely, Jordan's failure to disclose "interpreting code with an 
interpreter". The Examiner contends that Davidson discloses interpreting code, and 
writing the interpreter results to the stack evaluatively (referring to Fig. 1 and section 
3.2.2 par. 4 of Davidson). 

Applicant's present invention is not disclosed or suggested by Jordan, even 
considering the fiirther combination of Davidson. Applicant's claimed method and 
apparatus relate to and recite interpreting code with an interpreter and evaluativelv 
writing the results of said interpretation , and fiirther includes the step of scanning the 
results of said interpretation for the presence of proscribed code. Applicant's invention is 
an improvement over the prior art. 

First, there is no reason why one would seek to modify Jordan with the supposed 
teachings of Davidson. There must be some teaching or suggestion in order to make a 
modification. Jordan relates to methods and apparatus for detecting computer viruses 
that attempt to gain access to restricted computer system resources. (Abstract) Jordan 
attempts to use an emulator to emulate computer executable code in a subject file. Jordan 
attempts to recognize virus attempts by emulating the computer system code and the 
memory state caused by emulated instructions. Thus, what Jordan discloses in order for 
its detection system to fiinction is to detect the behavior of the code through emulation of 
the code. Jordan would not teach, suggest or disclose a reason to employ detection of 
results of interpreted code. Applicant's claimed step of interpreting provides the ability 
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for the Applicant's invention to perform its task, while Jordan is based on carrying out 

emulation of the code, and then monitoring that emulation. Applicant's invention noted 

the Jordan type prior art in discussing the drawbacks of the prior art, and the 

distinguishing feature of the Applicant's invention. 

Rather the interpreter used in the preferred embodiments first summarily 
evaluates code and then writes the results to a results table for further 
evaluation . This process of the preferred embodiments results in detection 
of the results of the interpreted code. This review of these results in the 
table is an improvement over the emulators, compilers and interpreters 
used in the prior art process which detected the behavior of the code. 

(Specification ^ [0021], emphasis added) 

Jordan does not provide a reason to make the modification proposed by the 
Examiner, nor would the proposed modification, if made to Jordan, arrive at the 
Applicant's claimed invention. Jordan appears to describe an emulator which requires the 
ability to execute the code of a specific platform for which the Jordan apparatus and 
methods are adapted. (See ^ [0032]) 

The Examiner's acknowledgement of Jordan's failure to provide an interpreter is 
not something which may be remedied by attempting to combine fiirther art, such as 
Davidson, which the Examiner contends provides the admitted missing element. 
Regardless of what Davidson shows, one would not be led to destroy the function and 
operation of Jordan. Jordan emulates code with an emulator and monitors the emulation 
and memory state modifications. Applicant interprets the code with an interpreter. This 
is entirely different. It is not clear how Jordan may be modified at all without destroying 
its fiinction, if one is to somehow turn what is disclosed in Jordan into the Applicant's 
claimed invention. One of ordinary skill in the art would not be led to modify Jordan, as 
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proposed. For these reasons, the Applicant's invention should be patentable, and the 
rejection withdrawn. 

The cited references fail to disclose or suggest Applicant's invention for additional 
reasons. As pointed out above, there is no disclosure pointed to which would provide the 
necessary motivation, or let alone a suggestion of making a modification to Jordan. 
However, even if the combination of Davidson with Jordan was attempted (which as 
Applicant asserts one of ordinary skill in the art would not have been led to do), one still 
would not arrive at the Applicant's claimed invention. Davidson even mentions that the 
"interpreter is divided into two phases: loading/linking and execution." Applicant's 
invention discloses and claims an interpreter which interprets code, and which 
evaluatively writes the results of said interpretation. The results are then scanned for the 
presence of proscribed code. Neither Jordan nor Davidson appears to disclose the 
Applicant's claimed invention. Davidson discusses the C virtual machine (CVM) code 
being executed. Jordan does not appear to even mention CVM, but rather discusses 
adapting its method and apparatus for different platforms. (See Jordan at ^ [0032]) 

One of ordinary skill in the art would not be led to combine Jordan with Davidson 
for additional reasons. Unlike an emulator, disclosed and relied on in Jordan, which is 
required to emulate, and hence process all of the code it encounters, the interpreter may 
rely on a known result from a string through memory to avoid having to process 
something where the result is known. This facilitates speed, and further distinguishes the 
Applicant's invention. However, attempting to modify Jordan which relies on emulation 
being carried out for emulated code execution to take place, as well as the emulated code 
execution memory state modification, would be inconsistent with what Jordan actually 
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discloses. Applicant, in its previously submitted response to the office action of February 
9, 2006, distinguished the interpreter from the emulator. For the same reasons that the 
Examiner agreed with Applicant in overcoming the rejection of Jordan and Afzal 
previously, those reasons are also applicable to show why one of ordinary skill in the art 
would not be led to modify Jordan, as the Examiner proposes. 

For the above reasons, reconsideration and a withdrawal of the Examiner's 
rejection of claims 1-4 and 6 is respectfully requested. 

Claims 5, 7-12 stand rejected under 35 USC 103(a) as being unpatentable over 
Jordan (2002/0073323 Al) in view of Davidson, as applied to claims 1-4, and further in 
view of US 5,728,901 ("Shieh"). This rejection is respectfully but strenuously traversed 
and reconsideration and a withdrawal of the rejection are hereby requested. 

The Examiner contends that with respect to claim 7, Jordan fails to disclose a 
pattern analyzer. This is further consistent with Applicant's position, discussed above, 
that Jordan's disclosure is of emulation of computer code, and monitoring the emulation. 
The pattern analyzer is what is disclosed and claimed by Applicant in conjunction with an 
interpreter. The pattem analyzer analyzes the results of Applicant's evaluative code 
interpreter. This is not emulating the code with an emulator, where line by line code 
execution is carried out, as Jordan appears to require. The Examiner already 
acknowledges that the interpreter is not found in Jordan. In addition, Shieh discloses a 
pattem oriented intrusion detection system. However, for the same reasons, it would not 
have been obvious to combine Davidson, or even the further reference Shieh, with 
Jordan. Considering the references for what they fairly disclose, there is still nothing to 
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suggest or teach modifying the emulator and method of Jordan, even with the further 
reference of Shieh. Accordingly, the rejection of claims 5 and 7-12 should be withdrawn. 

In the event an extension or further extension of time is required, one is 
respectfiilly requested, and the Conunissioner is hereby authorized to charge the 
Applicant's undersigned representative's deposit account for any fees which may be 
required in connection with any extension or the filing of this amendment/response. 



Respectfully submitted, 
JOHN F. A. EARLEY III 
FRANK J. BONINI, JR. 
CHARLES L. RIDDLE 

HARDING, EARLEY, FOLLMER & FRAILEY 
Attomeys for Applicant 
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